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Comprehensive Federal Privacy Legislation 





Can Build on State Privacy Laws 


THERE ARE THREE KEY COMPONENTS OF PRIVACY LEGISLATION: 


1 


ESTABLISHING 
CONSUMERS’ RIGHTS 





IN THEIR DATA 


California creates new 
consumer rights including: 


e Confirmation of Processing 
e Access 

e Correction 

e Deletion 

e Portability 


e Opt out of: (1) sale, and 
(2) sharing of personal 
information 


Virginia creates the same 
consumer rights but has a 
broader opt out right, allowing 
consumers to opt out of: 

(1) sale, (2) targeted 
advertising, and (3) certain 
types of “profiling” 


Federal Law should create 
these important consumer 
rights—and give consumers 
broad rights to opt out of 


processing, not limited to sale. 
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OBLIGATING COMPANIES TO 
HANDLE THAT DATA IN WAYS THAT 


DO NOT SURPRISE CONSUMERS 


California imposes several obligations 

on companies that decide how and why 

a consumer's data is collected and used, 
including: 

e Data minimization and purpose specification 
e Reasonable security measures 


e Prohibition on retaliating against consumers 
that exercise new rights 


Virginia creates a broader set of obligations 
on businesses that decide how and why 
consumers’ data is processed, including: 


e Putting the burden on companies to obtain 
a consumer's consent to process sensitive 
data and to obtain consent for unexpected 
processing 


e Prohibiting processing data in violation of 
state and federal non-discrimination laws 


California and Virginia both recognize the 
distinct role of service providers, including 
requiring them to process data pursuant to a 
contract. 


Federal Law should build on these obligations 
to ensure that companies use consumers’ 
personal data consistent with consumer 
expectations. 
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STRONG 


ENFORCEMENT 


California's law creates a new 
regulator to enforce the law's 
privacy provisions 


Virginia's law will be enforced 
by the Attorney General 


Federal Law should not be 
enforced by a single regulator, 
but by federal and state 
agencies working together. 


Federal: The FTC should 
enforce federal privacy law, 
with new tools including: 


1. Targeted rulemaking 
authority 


2. Authority to fine first-time 
violators 


3. Additional funding and staff 


State: Attorneys General 

in all states and territories 
should also enforce the law, 
adding 50+ new enforcement 
agencies. 








We urge Congress to enact a federal consumer privacy law that builds on state 


privacy protections in each area. Congress should build on privacy laws enacted 
by California and Virginia to protect consumers nationwide. 
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